Spear phishing is a targeted social engineering attack designed to persuade a specific person or group to reveal credentials, approve access, or run malicious content. It differs from broad spam because the message is tailored to the target’s role, tools, or business context.
Expanded Definition
Spear phishing is a precision social engineering technique that uses context, urgency, and credibility to manipulate a specific target into taking an action that benefits the attacker. In security operations, it often serves as the delivery path for credential theft, malware, business email compromise, or unauthorised payment approval. The attacker may impersonate a colleague, supplier, executive, or trusted service, and the message is usually shaped around the target’s role, current projects, or known relationships.
The term is sometimes used loosely to describe any phishing email, but that broad usage misses the defining feature: the message is tailored to a known person or narrowly defined group. That distinction matters because targeted lures are more persuasive and often bypass generic awareness training. Guidance from the NIST Cybersecurity Framework 2.0 is useful here because it frames the need for governance, awareness, and incident response as part of a broader risk management approach. The most common misapplication is calling every suspicious email spear phishing, which occurs when the message is generic rather than specifically tailored to the recipient.
Examples and Use Cases
Implementing defences against spear phishing rigorously often introduces user friction, requiring organisations to weigh stronger verification against the time cost of extra checks and approvals.
- A finance employee receives a message that appears to come from the CFO requesting an urgent wire transfer, with wording that mirrors an active acquisition or quarter-end process.
- A developer gets an email pretending to be from an internal platform team asking them to sign in to a fake OWASP-style login page to “restore access” to a code repository or cloud console.
- An executive assistant is asked to review a shared document that installs malicious payloads after the user approves a permissions prompt.
- A supplier impersonation email asks accounts payable to update bank details, exploiting business process familiarity rather than technical vulnerability.
- A security team uses CISA phishing guidance to run simulations, train reporting behaviour, and validate mailbox controls after seeing repeated impersonation attempts.
In practice, spear phishing is not limited to email. It can arrive through collaboration platforms, SMS, voice, or AI-assisted message generation, which is why targeted social engineering should be assessed across all channels where trust is established. The quality of the pretext, not the delivery medium, is what often determines success.
Why It Matters for Security Teams
Spear phishing is important because it converts human trust into access, and that can undermine even strong technical controls when the attacker reaches a privileged or high-impact account. For identity and access teams, the threat often shows up as credential reuse, consent abuse, session hijacking, or approval of malicious workflows. For NHI governance, the same pattern can be used to steal API keys, tokens, or service account secrets from developers and platform operators, creating non-human identity compromise that is harder to detect than a stolen password.
Security teams need to treat spear phishing as both a people risk and an access risk. Detection, hardening, and response should cover identity proofing, conditional access, phishing-resistant authentication, mailbox filtering, and reporting workflows. The concept also intersects with agentic AI because AI-generated lures can be highly personalised and operationally scalable, which raises the volume and plausibility of attacks. Organisations typically encounter the full business impact only after a fraudulent approval, account takeover, or downstream abuse, at which point spear phishing becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-63 and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-1 | Phishing resilience supports identity and access assurance in governance and protection. |
| NIST SP 800-63 | IAL/AAL | Assurance levels guide how strongly identities and authenticators should be verified. |
| OWASP Non-Human Identity Top 10 | Spear phishing often targets secrets and service credentials tied to non-human identities. | |
| OWASP Agentic AI Top 10 | Agentic AI can amplify targeted lures and automate personalised social engineering. | |
| NIST AI RMF | The AI RMF addresses trust, misuse, and harmful outcomes relevant to AI-assisted phishing. |
Protect tokens, keys, and service accounts with phishing-resistant handling and strict secret hygiene.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 1, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
